Revoke access once. Every app you've connected loses it within seconds.
OneHux Accounts is the identity layer your applications trust — one real session, checked by every connected app in real time over short-lived tokens, not six separate copies of "logged in" quietly drifting out of sync.
Who it's for
The builder
You're wiring login into your product once and never rebuilding it per app. You get exact token lifetimes, exact scopes, and a real revoke endpoint — not a vague "enterprise SSO available on request."
The buyer
You're deciding whether one identity provider can hold every login across every brand you run. Each Organization is isolated by design — your users, your roles, your audit trail, never mixed with anyone else's.
The end user
You never chose OneHux Accounts and you're not meant to notice it. You sign in once, and it stays out of your way until you sign out — everywhere, at once.
How it works
The same Authorization Code + PKCE exchange every connected app goes through — no custom protocol to learn.
01
An app checks for a valid session.
02
No session — it redirects to OneHux Accounts.
03
The person signs in once; a code comes back.
04
The app exchanges it for a signed, short-lived token.
Security & trust
Short-lived tokens
Access tokens expire in 15 minutes. A stolen token is a narrow window, not a standing key.
Real-time session revocation
Revoking a session invalidates its token immediately — checked on every request, not just removed from a list you happen to be looking at.
Full audit trail
Every sign-in, permission change, and session revocation is logged against your Organization — filterable by type, user, and date.
Per-Organization data isolation
Every user, role, and session belongs to exactly one Organization. Two Organizations never share a user record, even if the email address matches.
Selling this to your own users
If you run a product with your own customers, your Organization can carry its own identity — not a re-skinned OneHux page.
Your own domain
A custom domain for your sign-in pages.
Roles you define
Every Organization defines its own Roles and Permissions — never a fixed list decided for you.
Your own branding
Your logo and accent color on the login screen.
Read the token, not the marketing
The docs are open once you're in — here's what a real token exchange actually returns.
POST /api/v1/oauth/token/
{
"grant_type": "authorization_code",
"code": "...",
"code_verifier": "...",
"client_id": "onehux_client_..."
}
200 OK
{
"access_token": "eyJhbGciOiJIUzI1NiIs...",
"token_type": "Bearer",
"expires_in": 900,
"scope": "openid profile email roles"
}